System and method for securing a program's execution in a network environment

• US 6,351,816 B1
• Filed: 10/10/1997
• Issued: 02/26/2002
• Est. Priority Date: 05/30/1996
• Status: Expired due to Term

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Connelly, David, Mueller, Marianne
• Primary Examiner(s): LE, DIEU MINH T
• Application Number:
  US08/949,042
• Time in Patent Office: 1,600 Days
• Field of Search: 713/200, 713/201, 713/202, 380/3, 380/4, 380/23, 380/25, 380/28, 380/29, 709/203, 709/223, 709/305
• US Class Current: 713/176
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A system and method is provided for managing security on a server that receives code for execution. A security manager resides on a server and determines whether to permit the execution of a servlet based on a characteristic of the servlet. The security manager makes this determination by performing a number of security checks implemented as a security policy that is configured based on the servlet'"'"'s network source.

Claims

1. A computer-implemented method for signing a first archive file, said method comprising:

selecting one of a plurality of security algorithms for use with said first archive file;

computing a signature for said first archive file according to said selected security algorithm; and

creating a new archive file comprising said first archive file, said selected security algorithm and said signature.

2. The method of claim 1, wherein said first archive file comprises a single file.

3. The method of claim 1, wherein said selecting comprises selecting a certificate-based algorithm for use with said first archive file.

4. A computer-readable medium containing instructions for performing a method for causing a computer system to sign a first archive file, said method comprising:

selecting one of a plurality of security algorithms for use with said first archive file;

computing a signature for said first archive file according to said selected security algorithm; and

creating a new archive file comprising said first archive file, said selected security algorithm and said signature.

5. A computer-implemented method for validating a signed archive file comprising an included archive file, an associated security algorithm and a signature, said method comprising:

extracting said included archive file, said associated security algorithm, and said signature from said signed archive file, wherein the associated security algorithm is selected from one of a plurality of security algorithms for use with said included archive file;

calculating a value for said included archive file according to said associated security algorithm;

extracting a corresponding value from said signature; and

determining said archive file as valid when said calculated value and said extracted corresponding value compare equal.

6. The method of claim 5, wherein said extracting of a corresponding value comprises conferring with a certificate authority to obtain a certificate for verifying said signature.

7. A computer-readable medium containing instructions for performing a method for causing a computer system to validate a signed archive file comprising an included archive file, an associated security algorithm and a signature, said method comprising:

extracting said included archive file, said associated security algorithm, and said signature from said signed archive file, wherein the associated security algorithm is selected from one of a plurality of security algorithms for use with said included archive file;

calculating a value for said included archive file according to said associated security algorithm;

extracting a corresponding value from said signature; and

determining said archive file as valid when said calculated value and said extracted corresponding value compare equal.

8. A computer system comprising:

a medium for data storage wherein is located a computer program for causing a computer system to validate a signed archive file comprising an included archive file, an associated security algorithm and a signature by

extracting said included archive file, said associated security algorithm, and said signature from said signed archive file, wherein the associated security algorithm is selected from one of a plurality of security algorithms for use with said included archive file;

calculating a value for said included archive file according to said associated security algorithm;

extracting a corresponding value from said signature; and

determining said archive file as valid when said calculated value and said extracted corresponding value compare equal; and

a CPU couple to said medium, for executing computer programs.

9. A medium for data storage comprising:

a first program for creating a first archive file;

a second program for

selecting one of a plurality of security algorithms for use with said first archive file;

computing a signature for said first archive file according to said selected security algorithm; and

creating a new archive file comprising said first archive file, said selected security algorithm and said signature; and

a CPU, coupled to said data storage medium, for executing computer programs.

10. A computer-implemented method for signing a first archive file, said method comprising:

selecting one of a plurality of security algorithms for use with said first archive file;

computing a signature for said first archive file according to said selected security algorithm; and

creating a new archive file comprising said first archive file, said selected security algorithm, said signature, and a certificate.